BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

3 BIOCs match the current filters. tactic: TA0005 ✕ technique: T1216 ✕

Download CSV Show ATT&CK heatmap
  • Execution of commonly abused AutoIT script Informational Execution

    AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.

    Indicator:

    Process action type = execution AND process execution signature = Signed , Weak Hash AND process execution signer = Autoit Consulting* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Script Proxy Execution (T1216)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Pubprn.vbs signed script proxy execution High Execution

    Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions.

    Indicator:

    Process action type = execution AND target process cmd = *pubprn.vbs*script:*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Script Proxy Execution: PubPrn (T1216.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rundll32.exe was used to run JavaScript Medium Execution

    Attackers may execute malicious JavaScript code (either remotely or locally) using rundll32.exe.

    Indicator:

    Process action type = execution AND target process cmd = * javascript:* AND target process name = rundll32.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Script Proxy Execution (T1216)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11